lumma | 2a8e192a035947a6705a550743727df5e78c7196d4b74527381f49742c35cd1a

General

Target

2a8e192a035947a6705a550743727df5e78c7196d4b74527381f49742c35cd1a
Size

333KB
Sample

240423-247w7acf2x
MD5

8a96e389677c0bf9506ab0402d14eb1a
SHA1

b1e6ea96f41139a95e527cbe9f350c07072df2dc
SHA256

2a8e192a035947a6705a550743727df5e78c7196d4b74527381f49742c35cd1a
SHA512

7c7a85e4619a08db8fe39ed8e1dcc777e7aec066a001c080e974309885a8fe8787c130e5afdcfd2ae78cc0f8476a0df355fb66046163ebfa0f06b18402d9691a
SSDEEP

6144:VzTzhHJ+/o/7EPDf3mzZf7chbZ5KqbI5T:RTzhHJSSqbAZq7E9

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

5.42.65.96:28380

Extracted

Family

redline

Botnet

@cloudcosmic (https://cloudcosmic.store)

C2

87.121.105.175:14845

Extracted

Family

lumma

C2

https://strollheavengwu.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Targets

- Target
  
  2a8e192a035947a6705a550743727df5e78c7196d4b74527381f49742c35cd1a
- Size
  
  333KB
- MD5
  
  8a96e389677c0bf9506ab0402d14eb1a
- SHA1
  
  b1e6ea96f41139a95e527cbe9f350c07072df2dc
- SHA256
  
  2a8e192a035947a6705a550743727df5e78c7196d4b74527381f49742c35cd1a
- SHA512
  
  7c7a85e4619a08db8fe39ed8e1dcc777e7aec066a001c080e974309885a8fe8787c130e5afdcfd2ae78cc0f8476a0df355fb66046163ebfa0f06b18402d9691a
- SSDEEP
  
  6144:VzTzhHJ+/o/7EPDf3mzZf7chbZ5KqbI5T:RTzhHJSSqbAZq7E9
Score

10^/10

lumma redline smokeloader zgrat @cloudcosmic (https://cloudcosmic.store)logsdiller cloud (telegram: @logsdillabot)pub1 backdoor bootkit discovery infostealer persistence rat spyware stealer trojan
- Detect ZGRat V1
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2